Security Operations Center (SOC)

Security Operations Center (SOC)

This course is part of Cybersecurity Operations Fundamentals Specialization

Instructor: Cisco Learning & Certifications

Access provided by UC Davis

40,307 already enrolled

8 modules

Gain insight into a topic and learn the fundamentals.

372 reviews

1 week to complete

at 10 hours a week

Flexible schedule

Learn at your own pace

98%

Most learners liked this course

8 modules

Gain insight into a topic and learn the fundamentals.

372 reviews

1 week to complete

at 10 hours a week

Flexible schedule

Learn at your own pace

98%

Most learners liked this course

What you'll learn

Analyze SOC team roles and incident response workflows to effectively detect, investigate, and mitigate malicious network activity.
Apply SIEM and DevSecOps strategies to optimize security operations, streamline incident management, and improve organizational threat detection.

Details to know

Shareable certificate

Add to your LinkedIn profile

Assessments

29 assignments

Taught in English

See how employees at top companies are mastering in-demand skills

Learn more about Coursera for Business

logos of Petrobras, TATA, Danone, Capgemini, P&G and L'Oreal

Build your subject-matter expertise

This course is part of the Cybersecurity Operations Fundamentals Specialization

When you enroll in this course, you'll also be enrolled in this Specialization.

Learn new concepts from industry experts
Gain a foundational understanding of a subject or tool
Develop job-relevant skills with hands-on projects
Earn a shareable career certificate

There are 8 modules in this course

Learn the core functions of a Security Operations Center (SOC) and elevate your incident response skills with our comprehensive analyst training program designed for associate-level professionals. This course provides the essential skills to protect organizational assets against sophisticated cyber-attacks by focusing on SIEM integration, incident response workflows, and advanced threat-hunting techniques. Designed for associate-level analysts, the curriculum addresses the challenge of managing high-volume data by teaching you to leverage workflow management systems and automation to reduce incident detection time.

You will gain a deep understanding of SOC team roles, the business benefits of centralized monitoring, and the technical strategies required to balance proactive protection with operational agility. To succeed, participants should possess CCNA-level networking knowledge, familiarity with TCP/IP, and foundational experience with Windows and Linux operating systems. By the end of this course, you will be equipped to handle the complexities of modern cybersecurity, effectively mitigating threats while streamlining SOC operations for maximum efficiency in any enterprise landscape.

In this module, you will explore what a Security Operations Center, or SOC, does and how SOC team members support day-to-day security monitoring and response. You will identify common threat actors, their motivations, and the assets and systems they target. You will also examine why organizations implement SOCs, the business value they provide, and the technical and procedural challenges SOCs commonly face.

What's included

6 videos6 readings4 assignments

6 videosTotal 23 minutes

Introduction to Security Operations Center1 minute
SOC Defined4 minutes
SOC Environment Today7 minutes
Goal of a SOC4 minutes
Challenges of a SOC6 minutes
Wrap-Up1 minute

6 readingsTotal 18 minutes

Introduction to Security Operations Center2 minutes
SOC Defined2 minutes
SOC Environment Today5 minutes
Goal of a SOC4 minutes
Challenges of a SOC1 minute
Wrap-Up4 minutes

4 assignmentsTotal 60 minutes

SOC Environment Today10 minutes
Goal of a SOC Practice Quiz10 minutes
Challenges of a SOC Practice Quiz10 minutes
Introduction to Security Operations Center Course Exam30 minutes

In this module, you will examine the core responsibilities of a Security Operations Center (SOC) and how it works with other teams across the organization. You will place the SOC within the incident response lifecycle, from detection through recovery. You will also outline the key services a SOC provides across each incident response phase.

What's included

4 videos4 readings3 assignments

4 videosTotal 6 minutes

Introduction to Security Operations Center Processes and Services1 minute
SOC Interaction with Other Departments2 minutes
Common SOC Services2 minutes
Wrap-Up1 minute

4 readingsTotal 13 minutes

Introduction to Security Operations Center Processes and Services1 minute
SOC Interaction with Other Departments2 minutes
Common SOC Services7 minutes
Wrap-Up3 minutes

3 assignmentsTotal 40 minutes

SOC Interaction with Other Departments Practice Quiz10 minutes
Common SOC Services Practice Quiz10 minutes
Security Operations Center Processes and Services Course Exam20 minutes

In this module, you will distinguish common SOC types (for example, internal, outsourced, and hybrid) and the staffing considerations that shape each, such as roles, coverage models, and escalation paths. You will also compare SOC deployment models (on‑premises, cloud, and managed services) and connect each to typical consumer profiles based on needs like cost, control, scalability, and response expectations.

What's included

4 videos8 readings3 assignments

4 videosTotal 17 minutes

Introduction to SOC Deployment Models and Types1 minute
SOC Types and Staffing Considerations8 minutes
SOC Models and Their Consumers6 minutes
Wrap-Up1 minute

8 readingsTotal 25 minutes

Introduction to SOC Deployment Models and Types2 minutes
Introduction to SOC Types and Staffing Considerations1 minute
SOC Types and Staffing Considerations5 minutes
Compliance-Based SOC3 minutes
Operational-Based SOC5 minutes
Introduction to SOC Models and Their Consumers1 minute
SOC Models and Their Consumers5 minutes
Wrap-Up3 minutes

3 assignmentsTotal 40 minutes

SOC Types and Staffing Considerations Practice Quiz10 minutes
SOC Models and Their Consumers Practice Quiz10 minutes
SOC Deployment Models and Types Course Exam20 minutes

In this module, you will examine the core roles on an effective SOC team and how each role supports incident response. You will outline the key skills expected for common SOC positions and the primary tools each role relies on. You will also identify how SOC team members coordinate with one another and communicate with external groups during an incident.

What's included

4 videos7 readings3 assignments

4 videosTotal 9 minutes

Introduction to Staffing an Effective SOC Team1 minute
SOC Roles1 minute
Interaction of Various Roles Within the SOC6 minutes
Wrap-Up1 minute

7 readingsTotal 34 minutes

Introduction to Staffing an Effective SOC Team2 minutes
Introduction to SOC Roles3 minutes
SOC Roles5 minutes
SOC Tasks and Responsibilities Overview12 minutes
Introduction to Interaction of Different Roles Within the SOC1 minute
Interaction of Various Roles Within the SOC10 minutes
Wrap-Up1 minute

3 assignmentsTotal 40 minutes

SOC Roles Practice Quiz10 minutes
Interaction of Different Roles Within the SOC Practice Quiz10 minutes
Staffing an Effective SOC Team Course Exam20 minutes

In this module, you will identify the types of data a Security Operations Center (SOC) relies on and how security event data fits into SOC monitoring and analysis. You will distinguish SOC-relevant data sources and the kinds of events they produce. You will also review common SOC tools and the key features that support collecting, correlating, and analyzing security data.

What's included

5 videos14 readings3 assignments

5 videosTotal 15 minutes

Introduction to Security Events Data and SOC Analyst Tools1 minute
SOC Relevant Data and Security Event Data Introduction5 minutes
SOC Tools and Their Features5 minutes
SOC Tools and Their Features (Cont.)2 minutes
Wrap-Up1 minute

14 readingsTotal 66 minutes

Introduction to Security Events Data and SOC Analyst Tools2 minutes
SOC Relevant Data and Security Event Data Introduction3 minutes
Session Data3 minutes
Full Packet Capture4 minutes
Transaction Data3 minutes
Extracted Content4 minutes
Statistical Data4 minutes
Alert Data4 minutes
External Data3 minutes
Introduction to SOC Tools and Their Features2 minutes
SOC Tools and Their Features12 minutes
SOC Tools and Their Features (Cont.)13 minutes
Security Information and Event Management8 minutes
Wrap-Up1 minute

3 assignmentsTotal 40 minutes

SOC Relevant Data and Security Event Data Practice Quiz10 minutes
SOC Tools and Their Features Practice Quiz10 minutes
Security Events Data and SOC Analyst Tools Course Exam20 minutes

In this module, you will identify the external intelligence resources, regulatory bodies, and government and industry organizations a SOC communicates with. You will outline how these relationships support security operations and coordination across stakeholders. You will also describe the key policies, procedures, and governance rules that guide SOC engagement with users, HR, and legal when violations are detected.

What's included

4 videos6 readings3 assignments

4 videosTotal 14 minutes

Introduction to Developing Key Relationships with Internal and External Stakeholders2 minutes
Internal Stakeholders5 minutes
External Stakeholders6 minutes
Wrap-Up2 minutes

6 readingsTotal 37 minutes

Introduction to Developing Key Relationships with Internal and External Stakeholders5 minutes
Internal Stakeholders3 minutes
Internal Stakeholder Summary Table10 minutes
External Stakeholders4 minutes
External Stakeholder Summary Table5 minutes
Wrap-Up10 minutes

3 assignmentsTotal 40 minutes

Internal Stakeholders Practice Quiz10 minutes
External Stakeholders Practice Quiz10 minutes
Developing Key Relationships with Internal and External Stakeholders Course Exam20 minutes

In this module, you will focus on how SOC metrics are used to measure and communicate SOC effectiveness. You will examine core ideas behind security data aggregation and how it supports consistent reporting. You will explore Time to Detection (TTD) in a network security context and what it indicates about detection performance. You will consider how to describe the detection effectiveness of security controls using SOC-focused metrics.

What's included

6 videos6 readings5 assignments

6 videosTotal 12 minutes

Introduction to Understanding SOC Metrics1 minute
Security Data Aggregation3 minutes
Time to Detection2 minutes
Security Controls Detection Effectiveness2 minutes
SOC Metrics3 minutes
Wrap-Up1 minute

6 readingsTotal 40 minutes

Introduction to Understanding SOC Metrics3 minutes
Security Data Aggregation12 minutes
Time to Detection5 minutes
Security Controls Detection Effectiveness4 minutes
SOC Metrics15 minutes
Wrap-Up1 minute

5 assignmentsTotal 60 minutes

Security Data Aggregation Practice Quiz10 minutes
Time to Detection Practice Quiz10 minutes
Security Controls Detection Effectiveness Practice Quiz10 minutes
SOC Metrics Practice Quiz10 minutes
Understanding SOC Metrics Course Exam20 minutes

In this module, you will describe core SOC workflow management system (WMS) concepts and their role in security operations. You will outline how a typical workflow management system is integrated within a SOC. You will describe what SOC WMS integration involves across tools and processes. You will provide an example of how SOC workflow automation is applied in practice.